Joe Demesy

Name of the Vulnerable Software and Affected Versions: R versions prior to 4.0.3 Description: The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the `install.packages()` function from the interpreter. Recommendations: Update to version 4.0.3 to resolve the issue. As a temporary workaround, consider restricting the use of the `install.packages()` function and the R CMD install cli command until the update is applied.

The issue is related to the Content Security Policy (CSP) implementation in the Messages component of Apple OS X. It allows remote attackers to obtain sensitive information via a javascript: URL. The vulnerability is associated with a lack of protection for sensitive data, which can be exploited by a remote attacker to gain confidential information by navigating to a JavaScript link.